{"record":{"id":"2f5ff1ac218fd002","repo":"ory/hydra","slug":"server-error","errorCode":"server_error","errorMessage":"serialization failure","messagePattern":"serialization failure","errorType":"error_code","errorClass":"fosite.RFC6749Error","httpStatus":500,"severity":"error","filePath":"persistence/sql/persister_device.go","lineNumber":166,"sourceCode":"\t\tSession:           session,\n\t\tSubject:           subject,\n\t\tDeviceCodeActive:  true,\n\t\tUserCodeState:     r.GetUserCodeState(),\n\t}, nil\n}\n\n// CreateDeviceCodeSession creates a new device code session and stores it in the database. Implements DeviceAuthStorage.\nfunc (p *Persister) CreateDeviceAuthSession(ctx context.Context, deviceCodeSignature, userCodeSignature string, requester fosite.DeviceRequester) (err error) {\n\tctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, \"persistence.sql.CreateDeviceCodeSession\")\n\tdefer otelx.End(span, &err)\n\n\treq, err := p.sqlDeviceSchemaFromRequest(ctx, deviceCodeSignature, userCodeSignature, requester, requester.GetSession().GetExpiresAt(fosite.DeviceCode).UTC())\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tif err := sqlcon.HandleError(p.CreateWithNetwork(ctx, req)); errors.Is(err, sqlcon.ErrConcurrentUpdate()) {\n\t\treturn errors.Wrap(fosite.ErrSerializationFailure, err.Error())\n\t} else if errors.Is(err, sqlcon.ErrUniqueViolation()) {\n\t\treturn errors.Wrap(fosite.ErrExistingUserCodeSignature, err.Error())\n\t} else if err != nil {\n\t\treturn err\n\t}\n\n\treturn nil\n}\n\n// GetDeviceCodeSession returns a device code session from the database. Implements DeviceAuthStorage.\nfunc (p *Persister) GetDeviceCodeSession(ctx context.Context, signature string, session fosite.Session) (_ fosite.DeviceRequester, err error) {\n\tctx, span := p.r.Tracer(ctx).Tracer().Start(ctx, \"persistence.sql.GetDeviceCodeSession\")\n\tdefer otelx.End(span, &err)\n\n\tr := DeviceRequestSQL{}\n\tif err = p.QueryWithNetwork(ctx).Where(\"device_code_signature = ?\", signature).First(&r); errors.Is(err, sql.ErrNoRows) {\n\t\treturn nil, errors.WithStack(fosite.ErrNotFound)\n\t} else if err != nil {","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/persistence/sql/persister_device.go#L148-L184","documentation":"CreateDeviceAuthSession wraps fosite.ErrSerializationFailure (with hint message \"serialization failure\") when the underlying INSERT fails with a SQL concurrent-update error (sqlcon.ErrConcurrentUpdate). Fosite uses this sentinel to signal a transaction serialization conflict so the OAuth2 layer can retry the request. It surfaces with code server_error in the OAuth2 error response.","triggerScenarios":"Two concurrent device authorization attempts (or a unique/constraint race under a transaction isolation level that reports concurrent update, e.g. MySQL InnoDB) causing the INSERT into the device auth table to conflict; high-concurrency device login polls hitting the same rows.","commonSituations":"Multiple replicas of Hydra receiving device authorization requests simultaneously; MySQL deployments with REPEATABLE READ hitting lock conflicts; client retry storms on the device authorization endpoint.","solutions":["Retry the device authorization request (with backoff) — fosite clients are expected to treat ErrSerializationFailure as retryable.","Enable the SQL retry wrapper (e.g. max_concurrent_retries / retry configuration for the store) so the driver retries transparently.","Check for client-side duplicate requests causing races and add idempotency on the caller.","Consider a database with proper row-level locking or reduce isolation level contention (e.g. MySQL deadlock settings)."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if fosite.ErrSerializationFailure.Is(err) /* or errors.Is hint check */ {\n    // transient conflict: retry CreateDeviceAuthSession with exponential backoff\n}","preventionTips":["Retry device authorization on serialization failure hints before surfacing errors to users.","Configure SQL max_concurrent_retries in the deployment.","Avoid duplicate/parallel device authorization submissions from clients."],"tags":["database","concurrency","oauth2","retry"],"backgroundTag":"serialization-failure","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}